MmCreateShadowMapping

INT64 __stdcall MmCreateShadowMapping(PVOID Va, INT64 a2){
  MMPTE *v4; 
  UINT64 v5; 
  unsigned __int64 v6; 
  MMPTE *PteAddress; 
  MMPTE **v8; 
  __int64 v9; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *v11; 
  _EPROCESS *v12; 
  char v13; 
  INT64 v15; 
  INT64 v16[2]; 
  INT64 result[3]; 
  INT64 a12; 
  INT64 a13; 
  INT64 v20; 
  INT64 v21; 
  int v22; 
  int v23; 
  INT64 v24[4]; 
  _KAPC_STATE ApcState; 
  INT64 a3; 
  v16[0] = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  memset((INT64)result, 0i64);
  v23 = 1;
  a13 = (INT64)&MiSystemPartition;
  v22 = 12;
  v4 = (MMPTE *)((char *)Va + a2 - 1);
  MiInitializeColorBase((UINT64)Va, 0i64, (INT64)v24);
  v6 = MiPageTablesNeeded(Va, v4, v5);
  if( (int)MiGetPageTablePages((__int64)result, v6, v16) < 0 )
    return 0i64;
  a12 = v16[0];
  do
  {
    Va = MiGetPteAddress(Va);
    PteAddress = MiGetPteAddress(v4);
    *v8 = PteAddress;
    v4 = PteAddress;
    *(v8 - 1) = (MMPTE *)Va;
  }
  while( v9 != 1 );
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v11 = (_EPROCESS *)PsInitialSystemProcess;
  v12 = (_EPROCESS *)*((_QWORD *)CurrentThread + 23);
  if( v12 != (_EPROCESS *)PsInitialSystemProcess )
    KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
  --*((_WORD *)CurrentThread + 243);
  ExAcquirePushLockExclusiveEx((UINT64)&P2, 0i64);
  MiMakeShadowPageTableRange(
    (WCHAR *)Va,
    (INT64)v4,
    (INT64)&a3,
    3i64,
    (INT64)result,
    v15,
    v16[0],
    v16[1],
    result[0],
    result[1],
    result[2],
    a12,
    a13,
    v20,
    v21);
  v13 = _InterlockedExchangeAdd64((volatile signed __int64 *)&P2, 0xFFFFFFFFFFFFFFFFui64);
  if( (v13 & 2) != 0 && (v13 & 4) == 0 )
    ExfTryToWakePushLock((volatile INT64 *)&P2);
  KeAbPostRelease(&P2);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( v12 != v11 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  MiCleanupPageTablePages((INT64)result);
  return 1i64;
}

Referenced by: